ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax
It is currently Sat Aug 20, 2022 6:31 am

Unanswered topics | Active topics


»

All times are UTC



Post new topic  Reply to topic  Page 2 of 2
  [ 29 posts ]  Go to page Previous 1 2
  Print view Previous topic | Next topic 
Author Message
Vido
PostPosted: Sun Jan 14, 2018 4:18 am 

Joined: Wed Feb 22, 2017 12:08 am
Posts: 4
Firmwares for SOHO routers are using LZMA to pack firmwares, there is tool called binwalk, its written in python and if you using python 2 and have python-lzma installed binwalik will validate found headers an false-positives will be excluded from search, something simmilar could be done for quickbms I think, its idea
Top
   
Reply with quote  
DavidDineen
PostPosted: Thu Aug 16, 2018 7:27 am 

Joined: Thu Aug 16, 2018 7:22 am
Posts: 1
aluigi wrote:
Good. Anyway I have added view zstd to the list in the first post since it uses a phenq results 1 week magic number that allow to guess it at 100%.

Was looking for zstd compression recognising technique and was about to ask in a thread. But here I found 100% success technique. Thanks for mentioning the magic number, this solves my problem I was facing in my current project.


Last edited by DavidDineen on Sat Sep 19, 2020 10:02 pm, edited 5 times in total.

Top
   
Reply with quote  
aluigi
PostPosted: Wed Dec 12, 2018 10:00 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12982
In case someone is interested in some statistics, I have collected the most used compression algorithms used in my 2'023 quickbms scripts.
Some games uses zip-like archives and that means some numbers may be inflated, some scripts cover multiple formats and some algorithms may be invoked twice in few scripts just because they are for more than one format.
Code:
zlib    545
deflate 119
lzma    87
xmemdecompress (lzx) 61
lzss    56
lzo1x   49
gzip    49
lz4     44
lz77wii 21
oodle   21
bzip2   16
dk2/EA  15
zstd    10
custom  10
Top
   
Reply with quote  
GHFear
PostPosted: Sat Mar 23, 2019 12:52 am 
User avatar

Joined: Fri Mar 30, 2018 2:48 am
Posts: 289
Thanks! This has been very helpful lately :)
Just want to add how I spot RefPack/dk2 nowadays.
First off...
0xXX = random value.
RefPack/dk2 compression mostly looks like this "0xXX\0xFB" (where the 0xFB seems to be the tell tale sign of refpack.) and then right after is the Decompressed Size as a 4byte 32 bit integer / long. (to further confirm that it in fact is refpack/dk2.)
So all in all it looks like this "0xXX\0xFB\0x00\0x1B\0x62\0x1C"

Depending on the strength of the compression the strings can still be sorta readable like this: "c:\datatemp\inter\PS2\Neutral\Chapâs\Hogwarts\ZoneãONE_HW_Viaduct_E.nãnce_DD\LefTextur�'àET_BURNâOOK_PAPER.ss€"

If you see this pattern, use comtype dk2

_________________
If you appreciate my work and want to donate:
Paypal: ghfear@hotmail.com

AES Key Finder 1.9: https://zenhax.com/viewtopic.php?f=17&t=9407&start=20
Top
   
Reply with quote  
baloons34
PostPosted: Tue Jun 11, 2019 1:15 pm 

Joined: Tue Jun 11, 2019 1:04 pm
Posts: 3
GHFear wrote:
Thanks! This has been very helpful lately :)
Just want to add how I spot RefPack/dk2 nowadays.
First off...
0xXX = random value.
RefPack/dk2 compression mostly looks like this "0xXX\0xFB" (where the 0xFB seems to be the tell tale sign of refpack.) and then avis sur phenq france right after is the Decompressed Size as a 4byte 32 bit integer / long. (to further confirm that it in fact is refpack/dk2.)
So all in all it looks like this "0xXX\0xFB\0x00\0x1B\0x62\0x1C"

Depending on the strength of the compression the strings can still be sorta readable like this: "c:\datatemp\inter\PS2\Neutral\Chapâs\Hogwarts\ZoneãONE_HW_Viaduct_E.nãnce_DD\LefTextur�'àET_BURNâOOK_PAPER.ss€"

If you see this pattern, use comtype dk2

Thank you so much, all this info is so useful. I have spent hours on Google trying to get things straight for my new project and then found this thread which is just full of information. The zstd code is exactly what I was not getting right. You saved my time!


Last edited by baloons34 on Wed Jul 17, 2019 2:37 pm, edited 1 time in total.

Top
   
Reply with quote  
GHFear
PostPosted: Tue Jun 11, 2019 2:16 pm 
User avatar

Joined: Fri Mar 30, 2018 2:48 am
Posts: 289
baloons34 wrote:
Thank you so much, all this info is so useful. I have spent hours on Google trying to get things straight for my new project and then found this thread which is just full of information. The zstd code is exactly what I was not getting right. You saved my time!


I think you meant to thank aluigi :)

aluigi wrote:
This Guy!

_________________
If you appreciate my work and want to donate:
Paypal: ghfear@hotmail.com

AES Key Finder 1.9: https://zenhax.com/viewtopic.php?f=17&t=9407&start=20
Top
   
Reply with quote  
aluigi
PostPosted: Wed Jun 12, 2019 8:42 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12982
:D
Top
   
Reply with quote  
baloons34
PostPosted: Sun Jun 23, 2019 11:55 am 

Joined: Tue Jun 11, 2019 1:04 pm
Posts: 3
GHFear wrote:
baloons34 wrote:
Thank you so much, all this info is so useful. I have spent hours on Google trying to get things straight for my new project and then found this thread which is just full of information. The zstd code is exactly what I was not getting right. You saved my time!


I think you meant to thank aluigi :)

aluigi wrote:
This Guy!


Hahahaha yes you are right, I must thank alugi :D
Top
   
Reply with quote  
baloons34
PostPosted: Sun Jun 23, 2019 11:56 am 

Joined: Tue Jun 11, 2019 1:04 pm
Posts: 3
aluigi wrote:
:D


Thanks a lot Alugi :)
Top
   
Reply with quote  
Display posts from previous:  Sort by  
Post new topic  Reply to topic  Page 2 of 2
  [ 29 posts ]  Go to page Previous 1 2

»

All times are UTC

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited